Extracted

• • Target
    2026-10-08_d96f7b2d79032fd77b4a74c67006c34d_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 12.4MB
  • SHA256 b6b39b88f9a0b25a2738cbac1a695fa6778b0bd25d0c5d6666ffd015a6bd712a
  • MD5 d96f7b2d79032fd77b4a74c67006c34d
  • SHA1 db3eb95ece2124c1f0593c33d41509704c56ddf0
  • SHA512 dacd9c607ded7fa9feb688f197f124dac64ca93f8381da31a51a3f631671be17f410e14a4f255b7a0d19a74b4beb3da676abfdb05b2647b787ead76d2998a498
  • SSDEEP 98304:addddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddB:
  • TLSH
    T190D66B74E69CDD88E4472E30849A8EE4E77CFD85A850561331A43B4E39B7F0C52E52AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2